Prisma Cloud: How To Use Tags In An RQL Query Using Joins
2924
Created On 12/13/22 20:29 PM - Last Modified 02/07/25 22:36 PM
Question
How to use tags in an rql query using tags?
Environment
- Prisma Cloud
- Investigate Page
- RQL (resource query language)
Answer
There are multiple ways for using tags in RQL queries with joins as shown below in sample queries:
config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = $.tags[?any( key == AppType and value == ElasticBeanstalk )] does not exist as X; config from cloud.resource where api.name = 'aws-ec2-describe-network-interfaces' as Y; filter 'not $.Y.groups[*].groupId contains $.X.groupId or $.X.groupName == default'; show X;
config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' as X; config from cloud.resource where api.name = 'aws-ec2-describe-network-interfaces' as Y; filter 'not $.Y.groups[*].groupId contains $.X.groupId or $.X.groupName == default or $.X.tags[*].key contains AppType and $.X.tags[*].value contains ElasticBeanstalk'; show X;
Additional Information
View our documentation here on Joins in RQL.